ExtlClntAppOauthConfigurablePolicies

Represents the policies configured by the admin for an OAuth-enabled external client app.

This type extends Metadata and inherits its fields.

ExtlClntAppOauthConfigurablePolicies components have the suffix .ecaOauthPlcy and are stored in the extlClntAppOauthPolicies folder.

Introduced in API version 59.0.

The View all External Client Apps, view their settings, and edit their policies user permission is required for users with admin roles to configure OAuth policies.

• Type: string
• Required: No
• Introduced: API version 61.0
• Description: Name of the Apex handler.

• Type: string
• Required: No
• Introduced: API version 60.0
• Description: The execution user for the OAuth 2.0 client credentials flow. Salesforce returns access tokens on behalf of this user. This user must have the API Only permission.

• Type: string
• Required: No
• Introduced: API version 61.0
• Description: Custom scope names in a comma-separated list.

• Type: string
• Required: No
• Description: Permission set IDs in a comma-separated list. This field or commaSeparatedProfile is used when permittedUsersPolicyType is set to AdminApprovedPreAuthorized.

• Type: string
• Required: No
• Description: Profiles in a comma-separated list. This field or commaSeparatedPermissionSet is used when permittedUsersPolicyType is set to AdminApprovedPreAuthorized.

• Type: ExtlClntAppOauthPoliciesAttribute[]
• Required: No
• Description: Unique attributes to be included as admin defaults. The maximum number accepted is 128. Each custom attribute must have a unique key and use an available field.

• Type: string
• Required: No
• Introduced: API version 61.0
• Description: Username of the Apex handler’s execution user.

• Type: string

• Required: Yes

• Description: Required.

  The name of the external client app associated with this OAuth policies file.

• Type: JWTSessionTimeoutType (enumeration of type string)
• Required: No
• Introduced: API version 65.0
• Description: Specifies how the JWT-based access token timeout is defined for guest users.
• Possible values:

  • UserSession — Salesforce uses the value from the sessionTimeout field in the ProfileSessionSetting type for the Experience Cloud guest user profile.

    If there’s no profile session timeout for the user, Salesforce uses the sessionTimeout value from the SessionSettings type.

    If both are defined, Salesforce defaults to the profile session timeout.

  • Custom — Salesforce uses the value from the guestJwtTimeout field.

• Type: int (enumeration of type string)

• Required: No

• Description: If guestJwtSessionTimeoutType is set to Custom, this field defines the amount of time before a JWT-based access token issued to a guest user expires. Values are in minutes.

  These values are available in API version 61.0 and later.

  These values are available in API version 65.0 and later.

  If guestJwtSessionTimeoutType is set to UserSession, omit this field.

• Possible values:

  • 1 — 1 Minute
  • 5 — 5 Minutes
  • 10 — 10 Minutes
  • 15 — 15 Minutes
  • 30 — 30 Minutes
  • 60 — 1 Hour
  • 90 — 90 Minutes
  • 120 — 2 Hours
  • 240 — 4 Hours
  • 480 — 8 Hours
  • 720 — 12 Hours

• Type: string (enumeration of type string)

• Required: No

• Description: The policy that determines IP restrictions.

  Values are:

• Possible values:

  • Enforce
  • Bypass
  • Bypass_2factor
  • Enforce_RelaxRefresh

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If true, the client credentials flow is enabled. The default value is false.

• Type: boolean
• Required: No
• Introduced: API version 61.0
• Description: If true, the external client app can use the guest user variation of the Authorization Code and Credentials Flow. To use this flow variation, the external client app must also be configured to issue JWT-based access tokens. The default value is false.

• Type: boolean
• Required: No
• Description: Deprecated.

• Type: boolean
• Required: No
• Introduced: API version 60.0
• Description: If truetrue, the token exchange flow is enabled. The default value is false.

• Type: string
• Required: No
• Description: The OAuth policies name for the external client app.

• Type: JWTSessionTimeoutType (enumeration of type string)
• Required: No
• Introduced: API version 65.0
• Description: Specifies how the JWT-based access token timeout is defined for named users.
• Possible values:

  • UserSession — Salesforce uses the value from the sessionTimeout field in the ProfileSessionSetting type for the named user’s profile.

    If there’s no profile session timeout for the user, Salesforce uses the sessionTimeout value from the SessionSettings type.

    If both are defined, Salesforce defaults to the profile session timeout.

  • Custom — Salesforce uses the value from the namedUserJwtTimeout field.

• Type: int (enumeration of type string)

• Required: No

• Description: If namedUserJwtSessionTimeoutType is set to Custom, the amount of time before a JWT-based access token issued to a named user expires. Values are in minutes.

  These values are available in API version 61.0 and later.

  These values are available in API version 65.0 and later.

• Possible values:

  • 1 — 1 Minute
  • 5 — 5 Minutes
  • 10 — 10 Minutes
  • 15 — 15 Minutes
  • 30 — 30 Minutes
  • 60 — 1 Hour
  • 90 — 90 Minutes
  • 120 — 2 Hours
  • 240 — 4 Hours
  • 480 — 8 Hours
  • 720 — 12 Hours

• Type: PermittedUsersPolicyType (enumeration of type string)

• Required: No

• Description: The policy that determines which users are allowed in the external client app.

  Values are:

• Possible values:

  • AdminApprovedPreAuthorized
  • AllSelfAuthorized

• Type: PolicyAction (enumeration of type string)

• Required: No

• Description: Requires users to verify their identity with two-factor authentication when they log in to the external client app. Use RaiseSessionLevel along with requiredSessionLevel to determine the security posture.

  Values are:

• Possible values:

  • Block
  • RaiseSessionLevel

• Type: RefreshTokenPolicyType (enumeration of type string)

• Required: No

• Description: The type of policy that determines when a token must be refreshed.

  Values are:

• Possible values:

  • Infinite
  • SpecificInactivity
  • SpecificLifetime
  • Zero

• Type: int
• Required: No
• Description: The number of units of measure used to specify validity when refresh token policy type is set to SpecificInactivity or SpecificLifetime.

• Type: string (enumeration of type string)

• Required: No

• Description: The unit of measurement that is used to specify validity when refresh token policy type is set to SpecificInactivity or SpecificLifetime.

  Values are:

• Possible values:

  • Days
  • Hours
  • Months

• Type: SessionSecurityLevel (enumeration of type string)

• Required: No

• Description: Defines the security posture.

  Values are:

• Possible values:

  • HIGH_ASSURANCE
  • LOW
  • STANDARD

• Type: int
• Required: No
• Description: Length of time the external client app’s session lasts. This field applies only if the app issues opaque tokens.

• Type: string
• Required: No
• Description: URL where Salesforce sends a logout request when users log out of Salesforce.

• Type: string
• Required: No
• Description: URL where users are directed after they authenticate.

Represents admin-defined attributes that provide personal information to customize the external client app for a specific use case.

• Type: string

• Required: Yes

• Description: Required.

  The existing field that includes the desired information. For example, Organization.Country.

• Type: string

• Required: Yes

• Description: Required.

  A unique name for the attribute. For example, country.

This example shows an ExtlClntAppOauthConfigurablePolicies component.

1<?xml version="1.0" encoding="UTF-8"?>
2<ExtlClntAppOauthConfigurablePolicies xmlns="http://soap.sforce.com/2006/04/metadata">
3    <externalClientApplication>myeca</externalClientApplication>
4    <label>myecapolicy</label>
5    <apexHandler>MyEcaOauthApexHandler</apexHandler>
6    <executeHandlerAs>admin@example.org</executeHandlerAs>
7    <refreshTokenPolicyType>SpecificLifetime</refreshTokenPolicyType>
8    <refreshTokenValidityPeriod>1</refreshTokenValidityPeriod>
9    <refreshTokenValidityUnit>Days</refreshTokenValidityUnit>
10    <ipRelaxationPolicyType>Enforce</ipRelaxationPolicyType>
11    <permittedUsersPolicyType>AdminApprovedPreAuthorized</permittedUsersPolicyType>
12    <commaSeparatedPermissionSet>PermSetExample</commaSeparatedPermissionSet>
13    <commaSeparatedCustomScopes>CustomScopeExample</commaSeparatedCustomScopes>
14    <sessionTimeoutInMinutes>1</sessionTimeoutInMinutes>
15    <requiredSessionLevel>HIGH_ASSURANCE</requiredSessionLevel>
16    <policyAction>RaiseSessionLevel</policyAction>
17    <singleLogoutUrl>https://www.example.com</singleLogoutUrl>
18    <startUrl>https://www.example.com</startUrl>
19    <guestJwtSessionTimeoutType>UserSession</guestJwtSessionTimeoutType>
20    <namedUserJwtSessionTimeoutType>Custom</namedUserJwtSessionTimeoutType>
21    <namedUserJwtTimeout>10</namedUserJwtSessionTimeout>
22</ExtlClntAppOauthConfigurablePolicies>

This example package.xml that references the previous definition.

1<?xml version="1.0" encoding="UTF-8"?>
2<Package xmlns="http://soap.sforce.com/2006/04/metadata">
3    <types>
4        <members>*</members>
5        <name>ExternalClientApplication</name>
6    </types>
7    <types>
8        <members>*</members>
9        <name>ExtlClntAppOauthSettings</name>
10    </types>
11    <types>
12        <members>*</members>
13        <name>ExtlClntAppGlobalOauthSettings</name>
14    </types>
15    <types>
16        <members>*</members>
17        <name>ExtlClntAppOauthConfigurablePolicies</name>
18    </types>
19    <types>
20        <members>*</members>
21        <name>ExtlClntAppConfigurablePolicies</name>
22    </types>
23    <version>60.0</version>
24</Package>

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.